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I. Real Party in Interest 

The present application is assigned to Hewlett-Packard Company. Hewlett- 
Packard Company is the real party in interest, and is the assignee of Application No. 
09/838,205. 

II. Related Appeals and Interferences 

The Appellants' legal representative, or assignee, does not know of any other 
appeal or interferences which will affect or be directly affected by or have bearing on 
the Board's decision in the pending appeal. 

III. Status of Claims 

The claims currently pending in this application are Claims 1-7, all of which 
stand finally rejected. Claims 1-7 are being appealed. 

IV. Status of Amendments 

No amendments were filed after final rejection. 

V. Summary Claimed Subject Matter 

As recited in independent claim 1 , a method for identifying the source of an 
event in a computer network is disclosed. Such a method is encompassed by claim 
1 , and includes the Fig. 2 steps of associating an identifier tag with an event (block 
205) occurring within the computer network (e.g., lines 2-4 of paragraph [0019]), 
wherein the identifier tag uniquely identifies at least one collection computer 
monitoring the event based on a domain name (e.g., lines 4-5 of paragraph [0019]); 
receiving, in at least one management computer, information from the at least one 
collection computer (e.g., 120, 125, 130 and 135) that includes the identifier tag 
(block 210; e.g., lines 1-3 of paragraph [0023]); deriving, by the at least one 
management computer (105, lines 1-2 of paragraph [0023]), an identification of the 
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at least one collection computer from the identifier tag (block 215; e.g., lines 1-3 of 
paragraph [0024]) based on the domain name; and identifying to a user the source of 
the event using the identification (block 220; e.g., lines 1-2 of paragraph [0025]) of 
the at least one collection computer, the at least one collection computer being at 
least one of a collection computer and a group of collection computers (e.g., lines 5- 
7 of paragraph [0025]). 

Dependent claim 4 depends from independent claim 1 . Dependent claim 4 
recites that the step of identifying (block 220; line 1 of paragraph [0025]) comprises 
the step of: displaying to the user the identification of the at least one collection 
computer and a network address of a network element that generated the event 
(e.g., lines 9-12 of paragraph [0025] and lines 5-6 of paragraph [0026]). 

Dependent claim 5 depends from independent claim 1 . Dependent claim 5 
recites that the step of identifying (block 220; line 1 of paragraph [0025]) comprises 
the step of: mapping each collection computer to a group of collection computers 
using the identifier tag (lines 6-7 of paragraph [0025]); and identifying to the user the 
source of the event using the group of collection computers and a network address 
of a network element that generated the event (lines 8-10 of paragraph [0025]). 

Independent claim 7 is directed to a system for identifying the source of an 
event in a computer network (e.g., lines 1-2 of paragraph [0010]). As exemplified in 
Fig. 1, claim 7 recites a plurality of collection computers (e.g., 120, 125, 130 and 
135), wherein an identifier tag uniquely identifies each collection computer or group 
of collection computers based on a domain name (e.g., lines 2-7 of paragraph 
[0025]), and wherein the identifier tag is associated with an event occurring within 
the computer network (e.g., line 5 of paragraph [0023] and line 1 of paragraph 
[0025]); at least one management computer (e.g., 105) for receiving information from 
the plurality of collection computers that includes the identifier tag (e.g., lines 1-3 of 
paragraph [0023], wherein each management computer derives an identification of 
each collection computer or group of collection computers from the identifier tag 
based on the domain name (e.g., lines 2-7 of paragraph [0025]); and means for 
identifying to a user the source of the event using the identification of each collection 
computer or group of collection computers (e.g., 140, 145; e.g., lines 8-11 of 
paragraph [0018] and line 1 1 of paragraph [0025]). 
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VI. Grounds of Rejection to be Reviewed on Appeal 

The final Office Action presents the following grounds of rejection to be 
reviewed on appeal: 

A. Claims 1-3, 6 and 7 stand rejected under 35 U.S.C. §1 02(e) as being 
anticipated by U.S. Patent No. 6,425,008 (Lecheler et al.); and 

B. Claims 4 and 5 stand rejected under 35 U.S.C. §1 03(a) as being 
unpatentable over the Lecheler et al. patent. 

VII. Argument 

Independent claims 1 and 7 are allowable over U.S. Patent 6,425,008 
(Lecheler et al.). The Lecheler et al. patent does not teach or suggest Appellants 1 
claimed features of: (1) deriving, by at least one management computer, an 
identification of at least one collection computer from an identifier tag based on a 
domain name; and (2) identifying to a user the source of the event using the 
identification of the at least one collection computer, the at least one collection 
computer being at least one of a collection computer and a group of collection 
computers. Independent claims 1 and 7 are therefore allowable. 

A. The Lecheler et al. Patent Does Not Disclose Each And Every 
Element Recited In The Claims. 

The rejection under 35 U.S.C. §1 02(e) based on the Lecheler et al. patent 
cannot stand because the Lecheler et al. patent fails to either expressly or inherently 
disclose a number of features recited in independent claims 1 and 7. Additionally, 
the dependent claims recite combinations of features defining combinations of 
separately patentable subject matter not disclosed in the Lecheler et al. patent. To 
anticipate the claimed invention, the cited document must disclose each and every 
feature set forth in the claimed combination of features (see, MPEP § 2131). 

Appellants have disclosed that when a management computer receives event 
information including the identifier tag and when the management computer needs to 
display or use the source of an event, the management computer can, for example, 
derive the domain name of the collection computer from the identifier tag contained 
in the event (see, e.g., the specification at paragraph [0024]). The identifier tag can 
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be, for example, the name or domain name of the at least one collection computer, 
even if there is a group of collection computers sharing a like identity (e.g., 
specification at paragraph [0019]). As exemplified in Fig. 1, more than one collection 
computer (e.g., 120 and 125) can monitor a single event from a single domain (CO) 
to identify the source of an event in a computer network. 

The foregoing features are broadly encompassed by claims 1 and 7. For 
example, the Lecheler et al. patent does not disclose or suggest "deriving, by the at 
least one management computer, an identification of at least one collection computer 
from the identifier tag based on a domain name; and identifying to a user the source 
of an event using the identification of the at least one collection computer, the at 
least one collection computer being at least one of a collection computer and a group 
of collection computers," as recited in claim 1 . 

The Lecheler et al. patent discloses remote management of private networks 
having duplicate network addresses (title). As shown in Fig. 1, a single Level 1 
manager (e.g., 34) is connected to a customer network (e.g., 16). Clearly, as 
illustrated in Fig. 1, the Lecheler et al. patent does not teach or suggest a collection 
of Level 1 managers (e.g., 34, 36 and 38) sharing a like identity. Instead, the 
Lecheler et al. patent uses a level one manager 34 to detect errors within a customer 
domain 12, and to produce an error signal as well as a unique location identifier. 
See column 4, lines 15-42. As apparent from Fig. 1 , the overall construct of 
hierarchical connections between the private networks 16, level one manager 34 and 
the level 2 manager 40 as taught by the Lecheler et al. patent does not allow multiple 
level 1 managers (e.g., 34) receiving event reports occurring in a single private 
network (e.g., 16). Accordingly, the one-on-one connection between a private 
network and a level 1 manager as taught by the Lecheler et al. patent does not allow 
more than one level 1 manager monitoring a single event from a single private 
network. 

The Lecheler et al. patent explicitly sought to gain its advantage from "limiting 
the customer domain linked to a level one manger to managed customer networks 
with unique network addresses" (col. 4, lines 34-38). This is an explicit limitation that 
teaches away from Appellants 1 claimed feature of identifying to a user the source of 
the event using the identification of the at least one collection computer, the at least 
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one collection computer being at least one of a collection computer and a group of 
collection computers, as recited in claim 1. See, a/so, claim 7. 

For the foregoing reasons, Appellant's claims 1 and 7 are allowable over the 
Lecheler et al. patent. The remaining claims depend from independent claim 1 and 
recite additional advantageous features which further distinguish over the Lecheler et 
al. patent relied upon by the Examiner. Hence, for these additional reasons, the 
Lecheler et al. patent fails to disclose each and every limitation set forth in 
independent claims 1 and 7, and hence also in claims depending from these 
independent claims. 

For at least these reasons, the rejection of independent claims 1 and 7 is 
improper. Accordingly, the rejection should be reversed. 

B. The Examiner Has Failed To Establish A Prima Facie Case of 
Obviousness Based on the Lecheler et al. Patent To Reject dependent Claims 
4 And 5. 

On page 4 of the Office Action, dependent claims 4 and 5 are rejected as 
being unpatentable over the Lecheler et al. patent. This rejection is respectfully 
traversed. 

Claims 4 and 5 depend from independent claim 1 and recite additional 
advantageous features which further distinguish over the Lecheler et al. patent relied 
upon by the Examiner. Appellants have argued that the Lecheler et al. patent does 
not teach or suggest, among other claimed features, identifying to a user the source 
of an event using the identification of the at least one collection computer, the at 
least one collection computer being at least one of a collection computer and a group 
of collection computers, as recited in claim 1, and as similarly recited in claim 7. For 
the like reasons, the Lecheler et al. patent fails to teach or suggest displaying to the 
user the identification of the at least one collection computer and a network address 
of a network element that generated the event, as recited in claim 4; and the steps of 
mapping each collection computer to a group of collection computers using the 
identifier tag, and identifying to the user the source of the event using the group of 
collection computers and a network address of a network element that generated the 
event, as recited in claim 5. 
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For the foregoing reasons, the Examiner has not established a prima facie 
case of obviousness in rejecting dependent claims 4 and 5. Hence, dependent 
claims 4 and 5 are allowable over the Lecheler et al. patent. 

For at least these reasons, the rejection of dependent claims 4 and 5 is 
improper. Accordingly, the rejection should be reversed. 

VIII. Claims Appendix 

See attached Claims Appendix for a copy of the claims involved in the appeal. 

IX. Evidence Appendix 
None. 

X. Related Proceedings Appendix 
None. 

XI. CONCLUSION 

The Examiner has failed to establish that the Lecheler et al. patent teaches 
each and every element of independent claims 1 and 7; and has not established a 
prima facie case of obviousness in rejecting dependent claims 4 and 5. A reversal of 
the final rejection, and allowance of the present application, are therefore requested. 



Respectfully submitted, 



Buchanan Ingersoll & Rooney pc 



Date January 10. 2007 




PaJcieKu. Keane 
Registration No. 32858 



P.O. Box 1404 
Alexandria, VA 22313-1404 
703 836 6620 
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VIII. CLAIMS APPENDIX 



The Appealed Claims 

1 . A method for identifying the source of an event in a computer network, 
comprising the steps of: 

associating an identifier tag with an event occurring within the computer 
network, wherein the identifier tag uniquely identifies at least one collection computer 
monitoring the event based on a domain name; 

receiving, in at least one management computer, information from the at least 
one collection computer that includes the identifier tag; 

deriving, by the at least one management computer, an identification of the at 
least one collection computer from the identifier tag based on the domain name; and 

identifying to a user the source of the event using the identification of the at 
least one collection computer, the at least one collection computer being at least one 
of a collection computer and a group of collection computers. 

2. The method of claim 1 , wherein the identifier tag is a name of the at 
least one collection computer. 



3. The method of claim 1 , wherein the step of deriving comprises the step 

of: 

maintaining within the at least one management computer a database of 
identification information associated with identifier tags. 

4. The method of claim 1 , wherein the step of identifying comprises the 
step of: 
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displaying to the user the identification of the at least one collection computer 
and a network address of a network element that generated the event. 



5. The method of claim 1 , wherein the step of identifying comprises the 
step of: 

mapping each collection computer to a group of collection computers using 
the identifier tag; and 

identifying to the user the source of the event using the group of collection 
computers and a network address of a network element that generated the event. 



6. The method of claim 1 , further comprising the steps of: 

managing, by the collection computer, at least one network object; and 

resolving, by the collection computer, a network address of each network 
object into a resolved network address included in the information received at the at 
least one management computer. 



7. A system for identifying the source of an event in a computer network, 
comprising: 

a plurality of collection computers, wherein an identifier tag uniquely identifies 
each collection computer or group of collection computers based on a domain name, 
and wherein the identifier tag is associated with an event occurring within the 
computer network; 

at least one management computer for receiving information from the plurality 
of collection computers that includes the identifier tag, wherein each management 
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computer derives an identification of each collection computer or group of collection 
computers from the identifier tag based on the domain name; and 

means for identifying to a user the source of the event using the identification 
of each collection computer or group of collection computers. 



Claims Appendix - 3 
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IX. EVIDENCE APPENDIX 



None. 
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RELATED PROCEEDINGS APPENDIX 



Related Proceedings Appendix - 1 



